Is it possible to route Sandbox network traffic through the host VPN?

[lasofeli]

Hello!

I realize this isn't strictly related, but I was hoping someone here would know the answer.

I've been looking into trying to route my VMs's network traffic through a VPN on the host. For Hyper-V, I've been able to route the network traffic of the VMs through Mullvad by making use of a NAT switch, but it doesn't seem as if I could configure the network interface for sandbox.

I just wanted to know if there was a way to route the sandbox traffic through the host VPN or if I should give up and use Hyper-V for now.

[HotCakeX]

Hi,
I use Mullvad on one of my machines and Hyper-V (default switch), Windows Sandbox, WSA (Windows subsystem for Android) are all routed through the VPN. tried it with Mullvad's OpenVPN and WireGuard connections.

As far as I know it always worked that way and all the traffic was routed through host VPN. The only exception is Windows Defender Application Guard in Edge.

[HotCakeX]

Here are my settings

---

Hyper-V switches (didn't apply any customizations, these are just the defaults)

---

Windows Sandbox and Mullvad on the host OS

[lasofeli]

Looks like it's the "Local network sharing" toggle that needs to be turned on for Sandbox to work normally.

Does that not open up potential avenues for information leakage though? The reason I'm using a VPN is because I'm using university wifi, and it sounds like parts of my system will be open to access by people on that network if I toggle that on.

Or am I misunderstanding that entirely lol?

[HotCakeX]

Ah yes, that's the toggle you need. As long as your network location is set to public you will be fine. If network location is set to "not configured" or "public" in group policy (which was the default for me) and in the Windows Security app you see it's public, then it's public and your device automatically doesn't trust nearby devices. Windows Firewall doesn't allow data leakage in public network locations.

[HotCakeX]

More info:

• https://support.microsoft.com/en-us/windows/make-a-wi-fi-network-public-or-private-in-windows-0460117d-8d3e-a7ac-f003-7a0da607448d

• https://support.microsoft.com/en-us/windows/firewall-network-protection-in-windows-security-aef9838b-d081-fd75-3b1b-e5fa794c003b

• https://web.archive.org/web/20131206012006/http://windows.microsoft.com:80/en-us/windows7/choosing-a-network-location

  • This is old but still should apply

---

How Windows Firewall affects network locations

The Public network location blocks certain programs and services from running to help protect your computer from unauthorized access while you're connected to a network in a public place. If you're connected to a public network and Windows Firewall is turned on, some programs or services might ask you to allow them to communicate through the firewall so that they work properly.

When you allow a program to communicate through the firewall, it's allowed for every network with the same location as the network you're currently connected to. For example, if you connect to a network in a coffee shop and choose Public network as the location, and you then unblock an instant message program, that program will be unblocked for all public networks that you connect to.

If you plan to unblock multiple programs while you're connected to a public network, consider changing the network location to Home network or Work network. It might be safer to change this one network than affect every public network you connect to from that point on. But remember that if you make that change, your computer will be visible to others on the network, and this is a security risk.